INPUTS
1.9. APPENDIX: CASE STUDIES OF HUMAN ERROR LEADING TO ACCIDENTS OR FINANCIAL LOSSTO ACCIDENTS OR FINANCIAL LOSS
1.9.8. Failure to Explicitly Allocate Responsibility
Many errors have occurred due to failure to explicitly allocate responsibility between different individuals who need to coordinate their efforts. This is illustrated by the case study in this section.
Example 1.27
The following incident occurred because responsibility for plant equip- ment was not clearly defined, and workers in different teams, responsible to different supervisors, operated the same valves.
The flare stack shown in Figure 1.9 was used to dispose of surplus fuel gas, which was delivered from the gas holder by a booster through valves B and C. Valve C was normally left open because valve B was more accessible. One day the worker responsible for the gas holder saw that the gas pressure had started to fall. He therefore imported some gas from another unit. Nevertheless, a half hour later the gas holder was sucked in.
Gas in To furnaces
Fan
To furnaces
Fuel gas gasholder
Flare stack
From another plant
FIGURE 1 9 Valve B was Operated by Different Workers (Kletz, 1994b).
Another flare stack at a different plant had to be taken out of service for repair. A worker at this plant therefore locked open valves A and B so that he could use the "gas holder flare stack." He had done this before, though not recently, and some changes had been made since he last used the flare stack. He did not realize that this action would result in the gas holder emptying itself through valves C and B. He told three other men what he was going to do but he did not tell the gas holder worker as he did not know that this man needed to know.
1.9.9. Organizational Failures
This section illustrates some of the more global influences at the organizational level which create the preconditions for error. Inadequate policies in areas such as the design of the human-machine interface, procedures, training, and the organization of work will also have contributed implicitly to many of the other human errors considered in this chapter.
In a sense, all the incidents described so far have been management errors but this section describes two incidents which would not have occurred if the senior managers of the companies concerned had realized that they had a part to play in the prevention of accidents over and above exhortations to their employees to do better.
Example 1.28
A leak of ethylene from a badly made joint on a high pressure plant was ignited by an unknown cause and exploded, killing four men and causing extensive damage. After the explosion many changes were made to improve the standard of joint-making: better training, tools, and inspection.
Poor joint-making and the consequent leaks had been tolerated for a long time before the explosion as all sources of ignition had been eliminated and so leaks could not ignite, or so it was believed. The plant was part of a large corporation in which the individual divisions were allowed to be autonomous in technical matters. The other plants in the corporation had never believed that leaks of flammable gas could ignite.
Experience had taught them that sources of ignition were liable to occur, even though everything was done to remove known sources, and there- fore strenuous efforts had been made to prevent leaks. Unfortunately the managers of the ethylene plant had hardly any technical contact with the other plants, though they were not far away; handling flammable gases at high pressure was, they believed, a specialized technology and little could be learned from those who handled them at low pressure.
Example 1.29
Traces of water were removed from a flammable solvent in two vessels containing a drying agent. While one vessel was on-line, the other was emptied by blowing with nitrogen and then regenerated. The changeover valves were operated electrically. Their control gear was located in a Division 2 area and as it could not be obtained in a nonsparkingform, it was housed in a metal cabinet which was purged with nitrogen to prevent any flammable gas in the surrounding atmosphere leaking in. If the nitrogen pressure fell below a preset value (about 1/2-inch water gauge) a switch isolated the power supply. Despite these precautions an explosion occurred in the metal cabinet, injuring the inexperienced engineer who was starting up the unit.
The nitrogen supply used to purge the metal cabinet was also used to blow out the dryers. When the nitrogen supply fell from time to time (due to excessive use elsewhere on the site), solvent from the dryers passed through leaking valves into the nitrogen supply line, and found its way into the metal cabinet. The nitrogen pressure then fell so low that some air diffused into the cabinet.
Because the nitrogen pressure was unreliable it was difficult to maintain a pressure of 1/2-inch water gauge in the metal cabinet. The workers complained that the safety switch kept isolating the electricity supply, so an electrician reduced the setpoint first to 1/t inch and then to zero, thus effectively bypassing the switch. The setpoint could not be seen unless the cover of the switch was removed and the electrician told no one what he had done. The workers thought he was a good electrician who had prevented spurious trips. Solvent and air leaked into the cabinet, as already described, and the next time the electricity supply was switched there was an explosion.
The immediate causes of the explosion were the contamination of the nitrogen, the leaky cabinet (made from thin steel sheet) and the lack of any procedure for authorizing, recording, and checking changes in trip settings. However, the designers were also at fault in not realizing that the nitrogen supply was unreliable and liable to be contaminated and that it is difficult to maintain a pressure in boxes made from thin sheet. If a hazard and operability study had been carried out on the service lines, with operating staff present, these facts, well known to the operating staff, would have been made known to the designers. It might also have brought out the fact that compressed air could have been used instead of nitrogen to prevent diffusion into the cabinet.
The controJ cabinet did not have to be in a Division 2 area. A convenient location was chosen and the electrical designers were asked to supply equipment suitable for the location. They did not ask if the
cabinet had to be in a Division 2 area. This was not seen as their job. They perceived their job as being to provide equipment suitable for the classification which had already been agreed.